7.5 The Device Investigation Page

The Device Investigation Page

By the end of this subsection, you will be able to read a device timeline, identify malicious process chains, and use the device page for investigation alongside KQL.

The device page in Defender XDR is the single-device investigation interface. It combines the device timeline (every process, network connection, file event, and registry change), device properties, security recommendations, and response actions in one view.

The device timeline

The timeline is a chronological view of everything that happened on the device. It is the most detailed investigation data source for endpoint activity — more granular than the aggregated tables in Advanced Hunting.

Event types in the timeline:

Reading a malicious process chain

The most critical skill for device investigation is reading the process tree — the parent-child relationship between processes.

Normal process chain: explorer.exe → outlook.exe → winword.exe (user opens Outlook, opens a Word attachment). This is a legitimate chain.

Malicious process chain: winword.exe → cmd.exe → powershell.exe → mimikatz.exe This means: Word executed a macro that launched cmd, which launched PowerShell, which launched Mimikatz (credential dumping). Each step is a red flag:

• Word spawning cmd.exe = macro execution (ASR rule target)
• cmd spawning PowerShell = script execution (common malware delivery)
• PowerShell spawning mimikatz = credential theft (immediate containment)

1
2
3
4
5
6
7

DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where DeviceName == "DESKTOP-NGE042"
| where InitiatingProcessParentFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe")
| project TimeGenerated, InitiatingProcessParentFileName,
    InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by TimeGenerated asc

What to check on every device investigation

When you open a device page during an incident, check these five things in order:

1. Alert timeline — what triggered the investigation? Read the alert details first.
2. Process tree for the alert — click the alert to see the process chain. Read parent → child → grandchild.
3. Network connections from suspicious processes — did the malicious process connect to an external IP? That is likely C2.
4. File events — did the process create or modify files? Look for new executables, scripts, or persistence mechanisms.
5. Logon events — did a new account log on around the time of the alert? That could be lateral movement from another compromised device.

Network connection analysis from the timeline

After identifying a suspicious process, the next step is checking its network connections. C2 communication is the confirmation that the process is not just suspicious but actively communicating with the attacker.

1
2
3
4
5
6
7
8
9

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceName == "DESKTOP-NGE042"
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe")
| where RemoteIPType == "Public"
| project TimeGenerated, InitiatingProcessFileName,
    RemoteUrl, RemoteIP, RemotePort,
    InitiatingProcessCommandLine
| sort by TimeGenerated desc

File event analysis — what did the process drop?

1
2
3
4
5
6
7
8

DeviceFileEvents
| where TimeGenerated > ago(24h)
| where DeviceName == "DESKTOP-NGE042"
| where InitiatingProcessFileName =~ "powershell.exe"
| where ActionType == "FileCreated"
| project TimeGenerated, FileName, FolderPath, SHA256, FileSize,
    InitiatingProcessCommandLine
| sort by TimeGenerated desc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

let targetDevice = "DESKTOP-NGE042";
let psProcesses =
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where DeviceName == targetDevice
    | where InitiatingProcessFileName =~ "powershell.exe"
    | project PSTime = TimeGenerated, ProcessId, FileName, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceName == targetDevice
| join kind=inner psProcesses on $left.InitiatingProcessId == $right.ProcessId
| where TimeGenerated between (PSTime .. (PSTime + 1m))
| project TimeGenerated, FileName, RemoteUrl, RemoteIP, ProcessCommandLine